Abraxas Labs

Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching